Index: head/share/man/man4/enc.4 =================================================================== --- head/share/man/man4/enc.4 (revision 322309) +++ head/share/man/man4/enc.4 (revision 322310) @@ -1,132 +1,144 @@ .\" $OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $ .\" .\" Copyright (c) 1999 Angelos D. Keromytis .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" 3. All advertising materials mentioning features or use of this software .\" must display the following acknowledgement: .\" This product includes software developed by Angelos D. Keromytis. .\" 4. The name of the author may not be used to endorse or promote products .\" derived from this software without specific prior written permission. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" .\" $FreeBSD$ .\" -.Dd November 28, 2007 +.Dd August 9, 2017 .Dt ENC 4 .Os .Sh NAME .Nm enc .Nd Encapsulating Interface .Sh SYNOPSIS To compile this driver into the kernel, place the following line in your kernel configuration file: .Bd -ragged -offset indent .Cd "device enc" .Ed +.Pp +Alternatively, to load the driver as a +module at boot time, place the following line in +.Xr loader.conf 5 : +.Bd -literal -offset indent +if_enc_load="YES" +.Ed .Sh DESCRIPTION The .Nm interface is a software loopback mechanism that allows hosts or firewalls to filter .Xr ipsec 4 traffic using any firewall package that hooks in via the .Xr pfil 9 framework. .Pp The .Nm interface allows an administrator to see incoming and outgoing packets before and after they will be or have been processed by .Xr ipsec 4 via .Xr tcpdump 1 . .Pp The .Dq Li enc0 interface inherits all IPsec traffic. Thus all IPsec traffic can be filtered based on .Dq Li enc0 , and all IPsec traffic could be seen by invoking .Xr tcpdump 1 on the .Dq Li enc0 interface. .Pp What can be seen with .Xr tcpdump 1 and what will be passed on to the firewalls via the .Xr pfil 9 framework can be independently controlled using the following .Xr sysctl 8 variables: .Bl -column net.enc.out.ipsec_filter_mask 0x00000000 0x00000000 .It Sy "Name Defaults Suggested" .It "net.enc.out.ipsec_bpf_mask 0x00000003 0x00000001" .It "net.enc.out.ipsec_filter_mask 0x00000001 0x00000001" .It "net.enc.in.ipsec_bpf_mask 0x00000001 0x00000002" .It "net.enc.in.ipsec_filter_mask 0x00000001 0x00000002" .El .Pp For the incoming path a value of .Li 0x1 means .Dq Li before stripping off the outer header and .Li 0x2 means .Dq Li after stripping off the outer header . For the outgoing path .Li 0x1 means .Dq Li with only the inner header and .Li 0x2 means .Dq Li with outer and inner headers . .Bd -literal incoming path |------| ---- IPsec processing ---- (before) ---- (after) ----> | | | Host | <--- IPsec processing ---- (after) ----- (before) ---- | | outgoing path |------| .Ed .Pp Most people will want to run with the suggested defaults for .Cm ipsec_filter_mask and rely on the security policy database for the outer headers. +.Pp +Note that packets are captured by BPF before firewall processing. +The special value 0x4 can be configured in the +.Ar ipsec_bpf_mask +and packets will be also captured after firewall processing. .Sh EXAMPLES To see the packets the processed via .Xr ipsec 4 , adjust the .Xr sysctl 8 variables according to your need and run: .Pp .Dl "tcpdump -i enc0" .Sh SEE ALSO .Xr tcpdump 1 , .Xr bpf 4 , .Xr ipf 4 , .Xr ipfw 4 , .Xr ipsec 4 , .Xr pf 4 Index: head/sys/net/if_enc.c =================================================================== --- head/sys/net/if_enc.c (revision 322309) +++ head/sys/net/if_enc.c (revision 322310) @@ -1,426 +1,443 @@ /*- * Copyright (c) 2006 The FreeBSD Project. * Copyright (c) 2015 Andrey V. Elsukov * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ #include "opt_inet.h" #include "opt_inet6.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef INET6 #include #include #endif #include #include #define ENCMTU (1024+512) /* XXX this define must have the same value as in OpenBSD */ #define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */ #define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */ #define M_AUTH_AH 0x2000 /* header was authenticated (AH) */ struct enchdr { u_int32_t af; u_int32_t spi; u_int32_t flags; }; struct enc_softc { struct ifnet *sc_ifp; }; static VNET_DEFINE(struct enc_softc *, enc_sc); #define V_enc_sc VNET(enc_sc) static VNET_DEFINE(struct if_clone *, enc_cloner); #define V_enc_cloner VNET(enc_cloner) static int enc_ioctl(struct ifnet *, u_long, caddr_t); static int enc_output(struct ifnet *, struct mbuf *, const struct sockaddr *, struct route *); static int enc_clone_create(struct if_clone *, int, caddr_t); static void enc_clone_destroy(struct ifnet *); static int enc_add_hhooks(struct enc_softc *); static void enc_remove_hhooks(struct enc_softc *); static const char encname[] = "enc"; +#define IPSEC_ENC_AFTER_PFIL 0x04 /* * Before and after are relative to when we are stripping the * outer IP header. + * + * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing + * after PFIL hook execution. It might be useful when PFIL hook does + * some changes to the packet, e.g. address translation. If PFIL hook + * consumes mbuf, nothing will be captured. */ static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE; static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE; static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE; static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER; #define V_filter_mask_in VNET(filter_mask_in) #define V_bpf_mask_in VNET(bpf_mask_in) #define V_filter_mask_out VNET(filter_mask_out) #define V_bpf_mask_out VNET(bpf_mask_out) static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl"); static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl"); static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl"); SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0, "IPsec input firewall filter mask"); SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0, "IPsec input bpf mask"); SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0, "IPsec output firewall filter mask"); SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0, "IPsec output bpf mask"); static void enc_clone_destroy(struct ifnet *ifp) { struct enc_softc *sc; sc = ifp->if_softc; KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc")); bpfdetach(ifp); if_detach(ifp); if_free(ifp); free(sc, M_DEVBUF); V_enc_sc = NULL; } static int enc_clone_create(struct if_clone *ifc, int unit, caddr_t params) { struct ifnet *ifp; struct enc_softc *sc; sc = malloc(sizeof(struct enc_softc), M_DEVBUF, M_WAITOK | M_ZERO); ifp = sc->sc_ifp = if_alloc(IFT_ENC); if (ifp == NULL) { free(sc, M_DEVBUF); return (ENOSPC); } if (V_enc_sc != NULL) { if_free(ifp); free(sc, M_DEVBUF); return (EEXIST); } V_enc_sc = sc; if_initname(ifp, encname, unit); ifp->if_mtu = ENCMTU; ifp->if_ioctl = enc_ioctl; ifp->if_output = enc_output; ifp->if_softc = sc; if_attach(ifp); bpfattach(ifp, DLT_ENC, sizeof(struct enchdr)); return (0); } static int enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, struct route *ro) { m_freem(m); return (0); } static int enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) { if (cmd != SIOCSIFFLAGS) return (EINVAL); if (ifp->if_flags & IFF_UP) ifp->if_drv_flags |= IFF_DRV_RUNNING; else ifp->if_drv_flags &= ~IFF_DRV_RUNNING; return (0); } +static void +enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav, + int32_t hhook_type, uint8_t enc, uint8_t af) +{ + struct enchdr hdr; + + if (hhook_type == HHOOK_TYPE_IPSEC_IN && + (enc & V_bpf_mask_in) == 0) + return; + else if (hhook_type == HHOOK_TYPE_IPSEC_OUT && + (enc & V_bpf_mask_out) == 0) + return; + if (bpf_peers_present(ifp->if_bpf) == 0) + return; + hdr.af = af; + hdr.spi = sav->spi; + hdr.flags = 0; + if (sav->alg_enc != SADB_EALG_NONE) + hdr.flags |= M_CONF; + if (sav->alg_auth != SADB_AALG_NONE) + hdr.flags |= M_AUTH; + bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m); +} + /* * One helper hook function is used by any hook points. * + from hhook_type we can determine the packet direction: * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT; * + from hhook_id we can determine address family: AF_INET or AF_INET6; * + udata contains pointer to enc_softc; * + ctx_data contains pointer to struct ipsec_ctx_data. */ static int enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data, void *hdata, struct osd *hosd) { - struct enchdr hdr; struct ipsec_ctx_data *ctx; struct enc_softc *sc; struct ifnet *ifp, *rcvif; struct pfil_head *ph; int pdir; sc = (struct enc_softc *)udata; ifp = sc->sc_ifp; if ((ifp->if_flags & IFF_UP) == 0) return (0); ctx = (struct ipsec_ctx_data *)ctx_data; /* XXX: wrong hook point was used by caller? */ if (ctx->af != hhook_id) return (EPFNOSUPPORT); - if (((hhook_type == HHOOK_TYPE_IPSEC_IN && - (ctx->enc & V_bpf_mask_in) != 0) || - (hhook_type == HHOOK_TYPE_IPSEC_OUT && - (ctx->enc & V_bpf_mask_out) != 0)) && - bpf_peers_present(ifp->if_bpf) != 0) { - hdr.af = ctx->af; - hdr.spi = ctx->sav->spi; - hdr.flags = 0; - if (ctx->sav->alg_enc != SADB_EALG_NONE) - hdr.flags |= M_CONF; - if (ctx->sav->alg_auth != SADB_AALG_NONE) - hdr.flags |= M_AUTH; - bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp); - } - + enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af); switch (hhook_type) { case HHOOK_TYPE_IPSEC_IN: if (ctx->enc == IPSEC_ENC_BEFORE) { /* Do accounting only once */ if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1); if_inc_counter(ifp, IFCOUNTER_IBYTES, (*ctx->mp)->m_pkthdr.len); } if ((ctx->enc & V_filter_mask_in) == 0) return (0); /* skip pfil processing */ pdir = PFIL_IN; break; case HHOOK_TYPE_IPSEC_OUT: if (ctx->enc == IPSEC_ENC_BEFORE) { /* Do accounting only once */ if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); if_inc_counter(ifp, IFCOUNTER_OBYTES, (*ctx->mp)->m_pkthdr.len); } if ((ctx->enc & V_filter_mask_out) == 0) return (0); /* skip pfil processing */ pdir = PFIL_OUT; break; default: return (EINVAL); } switch (hhook_id) { #ifdef INET case AF_INET: ph = &V_inet_pfil_hook; break; #endif #ifdef INET6 case AF_INET6: ph = &V_inet6_pfil_hook; break; #endif default: ph = NULL; } if (ph == NULL || !PFIL_HOOKED(ph)) return (0); /* Make a packet looks like it was received on enc(4) */ rcvif = (*ctx->mp)->m_pkthdr.rcvif; (*ctx->mp)->m_pkthdr.rcvif = ifp; if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, ctx->inp) != 0 || *ctx->mp == NULL) { *ctx->mp = NULL; /* consumed by filter */ return (EACCES); } (*ctx->mp)->m_pkthdr.rcvif = rcvif; + enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, + IPSEC_ENC_AFTER_PFIL, ctx->af); return (0); } static int enc_add_hhooks(struct enc_softc *sc) { struct hookinfo hki; int error; error = EPFNOSUPPORT; hki.hook_func = enc_hhook; hki.hook_helper = NULL; hki.hook_udata = sc; #ifdef INET hki.hook_id = AF_INET; hki.hook_type = HHOOK_TYPE_IPSEC_IN; error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki, HHOOK_WAITOK); if (error != 0) return (error); hki.hook_type = HHOOK_TYPE_IPSEC_OUT; error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki, HHOOK_WAITOK); if (error != 0) return (error); #endif #ifdef INET6 hki.hook_id = AF_INET6; hki.hook_type = HHOOK_TYPE_IPSEC_IN; error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki, HHOOK_WAITOK); if (error != 0) return (error); hki.hook_type = HHOOK_TYPE_IPSEC_OUT; error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki, HHOOK_WAITOK); if (error != 0) return (error); #endif return (error); } static void enc_remove_hhooks(struct enc_softc *sc) { struct hookinfo hki; hki.hook_func = enc_hhook; hki.hook_helper = NULL; hki.hook_udata = sc; #ifdef INET hki.hook_id = AF_INET; hki.hook_type = HHOOK_TYPE_IPSEC_IN; hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki); hki.hook_type = HHOOK_TYPE_IPSEC_OUT; hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki); #endif #ifdef INET6 hki.hook_id = AF_INET6; hki.hook_type = HHOOK_TYPE_IPSEC_IN; hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki); hki.hook_type = HHOOK_TYPE_IPSEC_OUT; hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki); #endif } static void vnet_enc_init(const void *unused __unused) { V_enc_sc = NULL; V_enc_cloner = if_clone_simple(encname, enc_clone_create, enc_clone_destroy, 1); } VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY, vnet_enc_init, NULL); static void vnet_enc_init_proto(void *unused __unused) { KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc)); if (enc_add_hhooks(V_enc_sc) != 0) enc_clone_destroy(V_enc_sc->sc_ifp); } VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, vnet_enc_init_proto, NULL); static void vnet_enc_uninit(const void *unused __unused) { KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc)); if_clone_detach(V_enc_cloner); } VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY, vnet_enc_uninit, NULL); /* * The hhook consumer needs to go before ip[6]_destroy are called on * SI_ORDER_THIRD. */ static void vnet_enc_uninit_hhook(const void *unused __unused) { KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc)); enc_remove_hhooks(V_enc_sc); } VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH, vnet_enc_uninit_hhook, NULL); static int enc_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: case MOD_UNLOAD: break; default: return (EOPNOTSUPP); } return (0); } static moduledata_t enc_mod = { "if_enc", enc_modevent, 0 }; DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY); MODULE_VERSION(if_enc, 1);